One objective of computer security includes protection of information and property from theft, corruption, or natural disaster, while allowing the information and property to remain accessible and productive to authorized users. There are various strategies and techniques used to design secure operating systems. One technique enforces the principle of least privilege, where an entity has only the privileges that it uses for its function. That way even if an attacker gains access to one part of the system, fine-grained security ensures that it remains difficult for the attacker to access the rest of the system. Other techniques include subsystems that default to secure settings, and wherever possible are designed to “fail secure” rather than “fail insecure.” Ideally, a secure system can only be breached by a deliberate, conscious, knowledgeable, and free decision on the part of legitimate authorities. To address this, designers and operators of secure systems often assume that security breaches are inevitable and keep full audit trails of system activity to determine the mechanism and extent of security breaches after they occur.
One method of securing computer systems involves creating user roles, and assigning users to roles that limit the authority of the user to only those activities that the user is authorized to perform. For example, an operating system may have a concept of an administrator, a power user, and a limited user, each with fewer privileges than the previous. Separation of administrative privileges from normal user privileges makes an operating system more resistant to viruses and other malware. A system administrator, systems administrator, or sysadmin, is a person employed to maintain and operate a computer system and/or network. System administrators may be members of an information technology (IT) department. The duties of a system administrator are wide-ranging, and vary widely from one organization to another. System administrators are usually charged with installing, supporting, and maintaining servers or other computer systems, and planning for and responding to service outages and other problems. The term system administrator may also be used to describe a privilege level that a computer owner has to obtain on his or her own computer to perform certain actions even if the computer is not part of a larger system.
A common threat is a corrupt administrator or a malicious piece of software that manages to acquire administrative rights and attack a computer system to gain unauthorized access, steal data, or tamper with the computer system. For many systems, once a malicious user or application has administrative privileges the security design is foiled and all security is lost. To mitigate this threat, system designers employ auditing systems that ensure an audit trail is created for actions performed by any user, even an administrator. However, this leaves a risk that the audit trail can be modified or erased by the same malicious administrator, claimed to be erroneous, or claimed to originate from malware of which the administrator is not aware. There are systems, such as Microsoft Operations Manager 2007's Audit Collection Services (ACS) that collect audit trails from computers and copy them to a centralized database on a network server that potentially malicious administrators do not control. However, this introduces a dependency on such a server, which may add network latency overhead and limited reliability when the network connection is unavailable. The administrator may even be able to sever the network connection to limit the effectiveness of such security models.